Secure Mailchimp Transactional inbound webhooks

Incoming mail through Mailchimp Transactional needs its own receiving configuration and webhook endpoint. Do not treat successful outbound authentication as evidence that your receiver can trust arbitrary incoming HTTP requests.

Establish routing and signature verification

1. Configure a dedicated inbound domain/route using the current Transactional documentation.
2. Point the route at the exact public HTTPS URL used for verification.
3. Implement the documented Transactional webhook signature with its signing key, including the URL and submitted parameters required by that scheme.
4. Parse the posted event collection and handle each event independently. An HTTP request can contain multiple events.

Reverse proxies, rewritten paths, or a different public URL can break URL-dependent verification. Fix the canonical URL configuration instead of disabling verification. Do not use a MailKite HMAC verifier or assume a raw-JSON signature model.

Validate receipt and replay

Send one controlled incoming message to the original address. Confirm route selection, signature validation, durable storage, and attachment policy. Acknowledge only after safe persistence and make duplicate events harmless.

Keep inbound events distinct from outgoing delivery/bounce notifications. A sender-controlled body must not authorize a privileged agent action simply because it arrived through an authentic provider callback.

For a detailed application path see Mandrill inbound. Moving to MailKite requires a different destination and signature contract as well as any payload mapping.